Incident: Connected Toy Security Failures: Children's Privacy at Risk.

Published Date: 2017-11-13

Postmortem Analysis
Timeline 1. The software failure incident involving security flaws in connected toys such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy happened in November 2017 [65157, 65174].
System 1. Bluetooth and wifi connections in the Furby Connect, i-Que Intelligent Robot, Toy-Fi Teddy, and CloudPets toys [65157, 65174]
Responsible Organization 1. The manufacturers of the toys - Hasbro, Genesis Toys, and Spiral Toys - were responsible for causing the software failure incident by producing toys with unsecured Bluetooth connections that could be easily hacked [65157, 65174].
Impacted Organization 1. Children playing with the toys [65157, 65174] 2. Parents and guardians of children using the toys [65157, 65174] 3. Retailers selling the connected toys [65157] 4. Toy manufacturers such as Hasbro, Genesis Toys, and Spiral Toys [65157, 65174] 5. The British Toy and Hobby Association [65157]
Software Causes 1. Lack of secure Bluetooth connections in the toys, allowing unauthorized access to communicate with children [65157, 65174] 2. Absence of authentication protections in the Bluetooth connections, enabling hackers to send messages to children [65157] 3. Vulnerabilities in the software of the toys, making it easy for individuals with malicious intent to manipulate the toys and communicate with children [65174]
Non-software Causes 1. Lack of proper authentication and security measures in the design of the toys, such as unsecured Bluetooth connections, making it easy for unauthorized individuals to access and communicate with the toys [65157, 65174]. 2. Insufficient consideration of privacy and security concerns in the development and manufacturing process of the toys, leading to potential risks for children's safety [65157, 65174]. 3. Potential vulnerabilities in the physical design of the toys, such as the range of Bluetooth connectivity, which could be exploited by individuals with malicious intent [65174].
Impacts 1. The software failure incident involving security flaws in connected toys such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy had the potential to put children's safety at risk by allowing strangers to communicate with them [65157, 65174]. 2. The vulnerabilities in the Bluetooth connections of these toys enabled unauthorized individuals to easily access and interact with the toys without requiring any authentication, posing a significant privacy and security risk [65157, 65174]. 3. The incident led to concerns about the lack of proper security measures in these connected toys, prompting a consumer safety group to urge major retailers to withdraw the toys from sale to prevent further risks to children [65157]. 4. The software failure incident highlighted the importance of prioritizing safety and security in connected toys, emphasizing the need for caution when purchasing such products to ensure children's well-being [65157]. 5. The incident raised awareness about the potential dangers of IoT devices and the importance of implementing robust security measures to protect user privacy and prevent unauthorized access [65174].
Preventions 1. Implementing secure Bluetooth connections with proper authentication protocols could have prevented the software failure incident [65157, 65174]. 2. Conducting thorough security testing and vulnerability assessments during the development phase of the toys could have identified and addressed the flaws before the products were released to the market [65157, 65174]. 3. Regularly updating the firmware of the toys to patch any security vulnerabilities could have prevented unauthorized access and potential hacking incidents [65174].
Fixes 1. Implementing secure Bluetooth connections with proper authentication protocols for the toys [65157, 65174]. 2. Conducting thorough security testing and vulnerability assessments on the software and firmware of the toys to identify and address any potential weaknesses [65157, 65174]. 3. Regularly updating the firmware of the toys to patch any discovered security vulnerabilities and enhance overall security [65174]. 4. Enhancing privacy and data protection measures within the toy apps to ensure children's personal information is safeguarded [65157, 65174]. 5. Collaborating with security experts and consumer safety groups to continuously monitor and improve the security of connected toys [65157, 65174].
References 1. Which? consumer group [Article 65157, Article 65174] 2. German consumer group Stiftung Warentest [Article 65157] 3. Hasbro (maker of Furby Connect) [Article 65157, Article 65174] 4. Genesis Toys (maker of I-Que Robot and My Friend Cayla) [Article 65157, Article 65174] 5. British Toy and Hobby Association [Article 65157]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to security vulnerabilities in connected toys has happened again at the same organization, specifically with Hasbro. The Furby Connect, made by Hasbro, was found to have security flaws that could allow unauthorized access to the toy [65157]. Hasbro stated that they designed the Furby Connect and its app to comply with children's privacy laws and ensure a secure play experience. However, the report by Which? highlighted the vulnerabilities in the toy's Bluetooth connection, indicating a recurring issue within the same organization. (b) The software failure incident involving security vulnerabilities in connected toys has also occurred with products from multiple organizations. The article mentions that other toys like the I-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy were found to have similar security flaws, allowing unauthorized access to communicate with children [65157]. These toys were manufactured by different companies such as Genesis Toys and Spiral Toys, indicating a broader issue across multiple organizations in the toy industry.
Phase (Design/Operation) design (a) The software failure incident in the articles can be attributed to the design phase. The security failures in the connected toys, such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy, were due to flaws in the design of the Bluetooth connections. The Bluetooth connections in these toys were not secured, allowing unauthorized access without the need for a password or authentication [65157, 65174]. These vulnerabilities were introduced during the development of the toys, indicating a design failure that put children's safety at risk.
Boundary (Internal/External) within_system (a) The software failure incident related to the security vulnerabilities in connected toys such as Furby Connect, I-Que Intelligent Robot, CloudPets, and Toy-fi Teddy was primarily within the system. The failure was due to flaws in the Bluetooth connections of these toys, which allowed unauthorized access and communication with children playing with the toys. The lack of proper authentication and security measures within the toys themselves made it easy for hackers to exploit the vulnerabilities and potentially harm children [65157, 65174].
Nature (Human/Non-human) non-human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in the articles is primarily due to security flaws in the Bluetooth and wifi-enabled toys, such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy. These flaws allowed strangers to communicate with children playing with the toys without needing a password or authentication, indicating a failure introduced without human participation [65157, 65174]. (b) The software failure incident occurring due to human actions: - The articles do not specifically mention any contributing factors introduced by human actions that led to the software failure incident. The focus is primarily on the security vulnerabilities in the toys themselves, indicating that the failure was not directly caused by human actions [65157, 65174].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - The articles do not mention any specific hardware-related failures that contributed to the software vulnerabilities in the connected toys. The focus is primarily on the lack of security measures in the Bluetooth connections of the toys, which allowed for potential hacking and unauthorized access to the toys [65157, 65174]. (b) The software failure incident occurring due to software: - The software failure incident in this case is primarily attributed to software vulnerabilities in the connected toys. The articles highlight that the security failures, such as unsecured Bluetooth connections, lack of authentication protections, and potential for hacking, were all software-related issues that allowed unauthorized access to the toys and communication with children playing with them [65157, 65174].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in the articles is related to a malicious objective. The security failures in the connected toys, such as Furby Connect, I-Que Intelligent Robot, CloudPets, and Toy-fi Teddy, were discovered to have vulnerabilities that could allow a stranger to communicate with a child using the toys without authentication. These vulnerabilities could be exploited by individuals with malicious intent to potentially harm children by sending messages or interacting with them through the toys without authorization [65157, 65174].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The software failure incident related to the security vulnerabilities in connected toys such as Furby Connect, I-Que Intelligent Robot, CloudPets, and Toy-fi Teddy can be attributed to poor decisions made during the design and implementation of these toys. The flaws in the Bluetooth connections of these toys, which allowed unauthorized access and communication with children, indicate a lack of proper security measures and oversight during the development process. The failure to secure the Bluetooth connections without requiring authentication or encryption demonstrates a significant oversight in ensuring the safety and privacy of the children using these toys. The incident highlights the consequences of poor decisions in prioritizing convenience and features over security and privacy concerns [65157, 65174]. (b) The software failure incident can also be attributed to accidental decisions or unintended consequences resulting from the design and implementation of the connected toys. The vulnerabilities discovered in the Bluetooth connections of the toys, which could potentially allow strangers to communicate with children, indicate unintended consequences of integrating connectivity features without adequate security measures. The lack of authentication protections in the Bluetooth connections may have been accidental oversights during the development process, leading to the exposure of children to potential risks. The incident underscores the importance of considering and addressing unintended consequences in the design and implementation of connected devices for children [65157, 65174].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the articles. The security failures in the connected toys, such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy, were due to the lack of professional competence in securing the Bluetooth connections of these toys. The Bluetooth connections had not been secured, requiring no password, pin, or authentication to gain access, making it easy for hackers to communicate with children playing with the toys [65157, 65174]. (b) The software failure incident related to accidental factors is also present in the articles. The vulnerabilities in the connected toys were accidental in the sense that they were not intentionally designed to be insecure but rather resulted from oversight or lack of thorough testing. For example, Hasbro, the maker of Furby Connect, mentioned that manipulating the toy to achieve the described hacking result would require specific conditions and a significant amount of engineering, indicating that the vulnerabilities were not intentional but accidental [65174].
Duration permanent, temporary (a) The software failure incident in the articles seems to be more of a permanent nature. The security failures in the connected toys, such as Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy, were due to inherent design flaws in the Bluetooth connections of these toys. These flaws allowed unauthorized access to the toys without the need for authentication, making it a systemic issue rather than a one-time occurrence [65157, 65174]. (b) However, it is worth noting that the exploitation of these security vulnerabilities would require close proximity to the toys and specific conditions to be satisfied, as mentioned by Hasbro regarding the Furby Connect toy. This indicates that while the vulnerabilities were present, the actual hacking or misuse of the toys might not be easily achievable under normal circumstances, making it a temporary failure in certain circumstances [65174].
Behaviour omission, other (a) crash: The articles do not mention any instances of software failures due to a crash where the system loses state and does not perform any of its intended functions [65157, 65174]. (b) omission: The software failures in the articles are related to omission, where the system omits to perform its intended functions at an instance(s). Specifically, the vulnerabilities in the Bluetooth connections of toys like Furby Connect, I-Que Intelligent Robot, CloudPets, and Toy-fi Teddy allowed unauthorized individuals to communicate with children playing with the toys, indicating an omission in the security measures [65157, 65174]. (c) timing: The articles do not mention any instances of software failures due to timing issues where the system performs its intended functions correctly but too late or too early [65157, 65174]. (d) value: The software failures in the articles are not related to the system performing its intended functions incorrectly [65157, 65174]. (e) byzantine: The software failures in the articles do not exhibit behaviors of a byzantine failure, where the system behaves erroneously with inconsistent responses and interactions [65157, 65174]. (f) other: The other behavior observed in the software failure incident is related to security vulnerabilities in the Bluetooth connections of the toys, allowing unauthorized access and communication with children, which can be classified as a security flaw [65157, 65174].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence harm, property, non-human, theoretical_consequence (a) death: There were no reports of people losing their lives due to the software failure incident in the articles [65157, 65174]. (b) harm: The software failure incident could potentially harm children as it allowed strangers to communicate with them through the vulnerable toys [65157, 65174]. (c) basic: There were no reports of people's access to food or shelter being impacted due to the software failure incident in the articles [65157, 65174]. (d) property: The software failure incident could impact people's privacy and data security as the vulnerable toys could be hacked to communicate with children [65157, 65174]. (e) delay: There were no reports of people having to postpone an activity due to the software failure incident in the articles [65157, 65174]. (f) non-human: The software failure incident impacted non-human entities, specifically the connected toys like Furby Connect, i-Que Intelligent Robot, CloudPets, and Toy-Fi Teddy [65157, 65174]. (g) no_consequence: The software failure incident had real observed consequences related to security vulnerabilities in the connected toys [65157, 65174]. (h) theoretical_consequence: The articles discussed potential consequences of the software failure incident, such as the risk of strangers communicating with children through the vulnerable toys [65157, 65174]. (i) other: There were no other consequences of the software failure incident mentioned in the articles [65157, 65174].
Domain information, entertainment (a) The articles discuss a software failure incident related to the production and distribution of information. The incident involves connected toys that had security vulnerabilities, allowing unauthorized individuals to communicate with children playing with the toys. The toys mentioned in the articles include Furby Connect, I-Que Intelligent Robot, CloudPets, and Toy-fi Teddy, all of which utilize Bluetooth connections that were found to be unsecured, posing risks to children's safety [65157, 65174].

Sources

Back to List